The version of fabric.js in the repo is quite out of date, this library has had an update to include a newer version of onchange, which itself had a number of security vulnerabilities patched.
See here:
fabricjs/fabric.js#7591

And the changes to onchange here:
https://github.com/Qard/onchange/pulls?q=is%3Apr+is%3Aclosed

Can the version of fabric.js be updated on this repo to get those changes. I see that it is a dependency of darkroom.js which itself looks to be no longer maintained.